{"id":"GHSA-vxgm-5rmg-5w8g","revision":"bd6cf5710f0148adab4042e2b9be359c","records":[{"revision":"bd6cf5710f0148adab4042e2b9be359c","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-vxgm-5rmg-5w8g","aliases":["CVE-2026-50134","GO-2026-5681"],"title":"Hugo: security.http.urls allow-list bypass via HTTP redirects","description":"**Commit:** [86fbb0f7a8](https://github.com/gohugoio/hugo/commit/86fbb0f7a8) — _security: Validate redirects against security.http.urls_\n**Affected versions:** v0.91.0 (when `security.http.urls` was introduced) through v0.161.1.\n**Fixed in:** v0.162.0.\n**Severity:** Only relevant for sites that rely on `security.http.urls` as a trust boundary — e.g. CI builds that fetch remote resources but want to constrain which hosts can be reached. Not an issue if you fully trust every URL passed to `resources.GetRemote`.\n\n**Description.** `resources.GetRemote` enforces `security.http.urls` on the URL it is called with, but until v0.162.0 it did not re-validate intermediate URLs on HTTP 3xx redirects. An allowed server (or an attacker controlling its DNS or response) could therefore redirect the request to a host that the policy was meant to forbid — for example, `http://localhost/` or an internal IP — and Hugo would fetch from the redirected target. The same bypass also lifted any host-shape restriction the operator had put in place.\n\n**Mitigation.** v0.162.0 installs a `CheckRedirect` on the HTTP client used by `resources.GetRemote` that re-runs `security.http.urls` on every redirect target and caps the redirect chain at 10 hops. No configuration change is required.","state":0,"publishedAt":"2026-06-16T19:22:37+00:00","modifiedAt":"2026-07-07T20:41:30.2981943+00:00","affected":[{"ecosystem":"Go","name":"github.com/gohugoio/hugo","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.91.0"},{"kind":"fixed","version":"0.162.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/gohugoio/hugo/security/advisories/GHSA-vxgm-5rmg-5w8g","https://github.com/gohugoio/hugo/commit/86fbb0f7a8bbb93e2e916390de9e5a4f24bf9f50","https://github.com/gohugoio/hugo","https://github.com/gohugoio/hugo/releases/tag/v0.162.0"],"sourceUrl":"https://github.com/advisories/GHSA-vxgm-5rmg-5w8g","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-vxgm-5rmg-5w8g","identifiers":["GHSA-vxgm-5rmg-5w8g","CVE-2026-50134","GO-2026-5681"]},"retained":false,"historicalAffected":[]}],"coverage":[]}